<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"><channel><title>Answers to: Session Fixation with Axon.ivy</title><link>https://answers.axonivy.com/questions/3053/session-fixation-with-axon-ivy</link><description>&lt;p&gt;Hi everyone, as far as I can find, every time user logs in with IVY Portal, the session is kept (not renewed). You can check this via &lt;em&gt;JSESSIONID&lt;/em&gt;. Thus, it leads to &lt;a href="https://www.owasp.org/index.php/Session_fixation"&gt;session fixation&lt;/a&gt; attack.&lt;br&gt;
May Axon.ivy provide a mechanism to prevent this kind of attack? I am using Axon.ivy 6.3.0.&lt;br&gt;
Thank you.&lt;/p&gt;</description><atom:link href="https://answers.axonivy.com/questions/3053/session-fixation-with-axon-ivy" rel="self"></atom:link><language>en</language><lastBuildDate>Wed, 09 May 2018 01:34:35 -0400</lastBuildDate><item><title>Answer by Alex Suter</title><link>https://answers.axonivy.com/questions/3053/session-fixation-with-axon-ivy/3261</link><description>&lt;p&gt;&lt;strong&gt;This issue has been fixed in ivy 7.1 and 7.0.4.&lt;/strong&gt;&lt;/p&gt;</description><dc:creator xmlns:dc="http://purl.org/dc/elements/1.1/">Alex Suter</dc:creator><pubDate>Wed, 09 May 2018 01:34:35 -0400</pubDate><guid>https://answers.axonivy.com/questions/3053/session-fixation-with-axon-ivy/3261</guid></item><item><title>Comment by ToanLC on Reto Weiss's answer</title><link>https://answers.axonivy.com/questions/3053/session-fixation-with-axon-ivy#3260</link><description>&lt;p&gt;Hello &lt;a href="https://answers.axonivy.com/users/863/bao-tran"&gt;&lt;a href="https://answers.axonivy.com/users/863/bao-tran"&gt;@Bao Tran&lt;/a&gt;&lt;/a&gt;,
Just want to update that this issue has been fixed in Ivy 7.0.4 &amp;amp; 7.1 as the US stated.
&lt;a href="https://developer.axonivy.com/doc/7.1.0/new-and-noteworthy"&gt;https://developer.axonivy.com/doc/7.1.0/new-and-noteworthy&lt;/a&gt;&lt;/p&gt;</description><dc:creator xmlns:dc="http://purl.org/dc/elements/1.1/">ToanLC</dc:creator><pubDate>Tue, 08 May 2018 23:54:19 -0400</pubDate><guid>https://answers.axonivy.com/questions/3053/session-fixation-with-axon-ivy#3260</guid></item><item><title>Comment by Bao Tran on Reto Weiss's answer</title><link>https://answers.axonivy.com/questions/3053/session-fixation-with-axon-ivy#3055</link><description>&lt;p&gt;Thank you for your answer. This means that there is nothing we can do now?&lt;/p&gt;</description><dc:creator xmlns:dc="http://purl.org/dc/elements/1.1/">Bao Tran</dc:creator><pubDate>Thu, 04 Jan 2018 04:37:14 -0500</pubDate><guid>https://answers.axonivy.com/questions/3053/session-fixation-with-axon-ivy#3055</guid></item><item><title>Answer by Reto Weiss</title><link>https://answers.axonivy.com/questions/3053/session-fixation-with-axon-ivy/3054</link><description>&lt;p&gt;Hi &lt;/p&gt;
&lt;p&gt;This is a known issue. See &lt;a href="https://jira.axonivy.com/jira/browse/XIVY-349"&gt;https://jira.axonivy.com/jira/browse/XIVY-349&lt;/a&gt;
Unfortunately, we cannot fix this issue without breaking RIA applications.
However, we plan to drop RIA support in Axon.ivy 8. After that we can fix this issue.&lt;/p&gt;
&lt;p&gt;Regards
Reto Weiss, Axon.ivy Support&lt;/p&gt;</description><dc:creator xmlns:dc="http://purl.org/dc/elements/1.1/">Reto Weiss</dc:creator><pubDate>Thu, 04 Jan 2018 04:20:10 -0500</pubDate><guid>https://answers.axonivy.com/questions/3053/session-fixation-with-axon-ivy/3054</guid></item></channel></rss>